After a file is deleted on a FAT file system, what is the status of its data blocks?

Prepare for the Computer Hacking Forensic Investigator v11 exam. Study with flashcards and multiple choice questions. Each question includes hints and explanations. Get exam-ready efficiently!

Multiple Choice

After a file is deleted on a FAT file system, what is the status of its data blocks?

Explanation:
The key idea is that deleting a file on FAT unlinks it and frees its storage. When you delete, the directory entry is cleared and the clusters it used are marked as unallocated in the FAT. The data blocks themselves aren’t erased immediately; they still contain the file’s bytes, but they’re no longer associated with any file and can be reused by the filesystem. So the correct understanding is that the data remains, but the file is no longer linked to it. This is why deleted data can sometimes be recovered until those blocks are overwritten. The other options don’t fit because deletion doesn’t immediately overwrite data, mark blocks as bad, or compress them.

The key idea is that deleting a file on FAT unlinks it and frees its storage. When you delete, the directory entry is cleared and the clusters it used are marked as unallocated in the FAT. The data blocks themselves aren’t erased immediately; they still contain the file’s bytes, but they’re no longer associated with any file and can be reused by the filesystem. So the correct understanding is that the data remains, but the file is no longer linked to it. This is why deleted data can sometimes be recovered until those blocks are overwritten. The other options don’t fit because deletion doesn’t immediately overwrite data, mark blocks as bad, or compress them.

Subscribe

Get the latest from Passetra

You can unsubscribe at any time. Read our privacy policy